Abstract: Quickly locating and accurately detecting malicious access requests in the domain name system has significant research value for ensuring network information security and economic security. A fewshot malicious domain name detection method based on an interlayer interaction perception attention network is proposed. First, a dualbranch network support branch and query branch are established using a metalearning training strategy. In the support branch, convolutional neural networks Vgg16 and GRU (gated recurrent unit) are used to extract the encoding features of domain names in temporal and spatial dimensions, respectively. Then, to promote information interaction between features of different dimensions, crossattention with temporal features is established at each layer in the spatial dimension. Finally, by calculating the similarity metric between query encoding features and interaction features, the legitimacy of the domain name to be tested can be quickly determined. Through testing on opensource malicious domain name datasets and fewshot family malicious domain name datasets, the results show that the proposed method can achieve 0.9895 detection precision in the binary classification task of normal domain names and malicious domain names, and 0.9682 average detection precision on 20 fewshot family malicious domain name datasets, which is superior to current classical malicious domain name detection methods.

Key words: malicious domain name detection, interaction perception, convolutional neural network, gated recurrent neural network, metalearning training strategy

摘要： 快速定位并准确检测出域名系统中的恶意访问请求，对保障网络信息安全与经济安全具有重要的研究价值，提出一种基于层间交互感知注意力网络的小样本恶意域名检测方法.首先，利用元学习训练策略建立支持分支和查询分支的双分支网络，并在支持分支中利用卷积神经网络Vgg16和门控循环单元(gated recurrent unit, GRU)分别提取域名字符串在时序维度和空间维度上的编码特征.然后，为了促进不同维度间特征的信息交互，在空间维度的每一层上建立时序特征的交叉注意力.最后，通过计算查询编码特征和交互特征之间的相似性度量，快速给出待测域名合法性的判定.通过在开源恶意域名数据集和小样本家族恶意域名数据集上进行测试，结果显示所提出方法在合法域名与恶意域名二分类任务上可以实现0.9895的检测精准率，在20个小样本家族恶意域名数据集上可以实现0.9682的平均检测精准率，优于当前经典的恶意域名检测方法.

关键词: 恶意域名检测, 交互感知网络, 卷积神经网络, 门控循环神经网络, 元学习训练策略